Reject pseudo class inside :not()

Source/core/html/HTMLContentElement.cpp

Index: Source/core/html/HTMLContentElement.cpp
diff --git a/Source/core/html/HTMLContentElement.cpp b/Source/core/html/HTMLContentElement.cpp
index 1602680764bd74a1c2d2c8518913c90b57bad8ad..228b23561e84a97f06a0e4400e35f77f0d05484e 100644
--- a/Source/core/html/HTMLContentElement.cpp
+++ b/Source/core/html/HTMLContentElement.cpp
@@ -82,6 +82,10 @@ void HTMLContentElement::parseAttribute(const QualifiedName& name, const AtomicS
 
 static inline bool includesDisallowedPseudoClass(const CSSSelector& selector)
 {
+    if (selector.pseudoType() == CSSSelector::PseudoNot) {
+        const CSSSelector* subSelector = selector.selectorList()->first();

[hayato, 2014/09/10 06:29:11]

It looks that current implementation of ':not()' can take only a simple
selector. Therefore, it is enough to check the first(). I understand.

According to the latest spec, http://dev.w3.org/csswg/selectors4/#negation,
':not()' can take a selector list as an argument. That means we should update
the code around here in the future if we support a selector list in an argument
of ':not()'.

I think the layout test you added will catch this kind of errors in the future.
I think we can land this patch as is.

+        return subSelector->match() == CSSSelector::PseudoClass;
+    }
     return selector.match() == CSSSelector::PseudoClass && selector.pseudoType() != CSSSelector::PseudoNot;

[hayato, 2014/09/10 06:29:11]

You can remove `selector.pseudoType() != CSSSelector::PseudoNot` from here
because this is always satisfied thanks to the previous `if ` statement (line
85).

[yurina1, 2014/09/10 11:02:53]

Done.

 }